PyPI/pretix CVE-2025-14881: low 3.8, EPSS 0.25%
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Action: Upgrade pretix to 2025.8.3 or later.
pip install pretix==2025.8.3pip install pretix==2025.9.3pip install pretix==2025.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2025.8.3 | - |
| 2025.9.0 | 2025.9.3 | - |
| 2025.10.0 | 2025.10.1 | - |
Fixed versions
| 2025.8.3 | 2025.9.3 | 2025.10.1 |
Sources
- osv: PYSEC-2026-1803
- nvd: CVE-2025-14881
- https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a
- https://github.com/pretix/pretix
- https://pretix.eu/about/en/blog/20251219-release-2025-10-1
- https://pypi.org/project/pretix
- https://github.com/advisories/GHSA-r2h2-g46h-8mx8
CVE-2025-14881 · published · modified · JSON